AI hacking agents are trying to break into Australian online stores

If you run an online store, the next attempt to break into it might not have a person behind it. Criminals are sending AI agents to probe ecommerce sites in Australia, the US and Japan. The agents work for hours, and about one try in ten gets in.

That estimate comes from security company NorForge, which published its findings on 19 October. It found more than 20 control panels for Cairn, an AI hacking system, left open on the internet. Through them, it could watch the attackers give their agents orders.

An Australian store was case one

The busiest group, which NorForge calls AIA0001, writes in Chinese and ran more than 1,100 attack projects. Most of its targets were in the US, Japan and Australia. Its aim, NorForge says, “seems to be to gain persistent access to e-commerce/payment infrastructure for later monetization”. Get in, stay in, cash in later.

A second group, writing in English, went after credit cards and cryptocurrency.

The first case in NorForge’s report is an Australian online store, which it doesn’t name. The agents found a way to change an account without logging in. From there they got to the point where they could run commands on the store’s web server. That’s close to full control of the site.

Reuters, in a report published by iTnews, says the campaign started on 25 September. By late last week the agents had tried more than 1,200 sites. Reuters says the hacker got into websites belonging to more than 100 companies, including Deere, SharkNinja and Cummins. It couldn’t establish how much data was taken. SharkNinja told Reuters a standalone product support site was hit and the threat contained. No Australian victim has been named.

Five dollars a go, and they never get bored

The cost is what makes this worth knowing. NorForge estimates an average attempt costs around five dollars in AI usage. Reuters reports the whole campaign used about US$5,000 of AI tokens, or roughly US$50 per successful break-in.

The agents are patient, too. The busiest group’s successful break-ins took a little under 23 hours on average, and one project ran for more than five days.

Put that together and an attacker can try a thousand stores for a few thousand dollars. No one has to sit at a keyboard. NorForge says it is helping Reuters notify victims and trying to get the panels taken down.

The tricks are old ones

None of this is exotic. The agents hunted for the usual holes: logins they could bypass, accounts they could take over, forms that let them slip in database commands, and upload boxes that accept the wrong files. One of their tools was an attack on a known flaw in Magento, an ecommerce platform many businesses host themselves.

That’s the good news. Updates and careful setup close many of these holes. ASD’s small business cyber security guide says “websites are a prime target for cyber attacks”, and its fixes are in the checklist.

A hosted platform such as Shopify handles some of the work for you. The apps you add and the logins you use are still your job, as our story on hijacked Shopify app settings shows. For the wider basics, see our plain-English guide to the Essential Eight.

If you think your store has been broken into, report it to ASD’s ACSC.

Checklist

• Update your store platform and plugins. If you run Magento or another self-hosted platform, ask whoever looks after the site to confirm it’s on the latest security release.
• Turn on automatic updates. Do it for the devices and software you use to run the store, as ASD’s small business guide recommends.
• Lock down the admin login. Use multi-factor authentication, or at least a strong passphrase, for every account that can change the store.
• Find out what your site exposes to the internet. Ask your developer or host which admin panels, remote access and other services can be reached from outside, and close what isn’t needed.
• Back up the store and test a restore. Make sure you could bring the site back after an attack.
• Report a suspected break-in. Use “Report a cyber security incident” at cyber.gov.au/report.